[LU-17624] SSK cannot be set up on a FIPS-enabled client

• Type: Bug
• Resolution: Fixed
• Priority: Minor
• Fix Version/s: Lustre 2.16.0
• Affects Version/s: Lustre 2.16.0
• Labels: SSK patch sec
• Severity: 3
• Assignee: Sebastien Buisson
• Reporter: Sebastien Buisson

Description

When trying to setup SSK on a FIPS enabled client we get:

# lgss_sk -t client -m /ssk_dir/testfs.server.key
Generating DH parameters, this can take a while...
error: cannot generate DH parameters

Adding more debug traces, we can see:

error:050C90CA:Diffie-Hellman routines:DH_generate_parameters_ex:non FIPS method

In FIPS mode, only certain crypto methods are allowed.